Ransomware group WhiteArmor listed no-KYC swap service Wagyu.xyz on its leak site on October 27-28, and Hudson Rock reviewed the purported order data supplied with the claim. The files cover July 18 to October 26, 2026, and the breach itself has not been independently authenticated.

The dump reportedly holds 38,628 order records and 10,139 distinct IP addresses. Of 8,137 orders paying out to native XMR addresses, 4,580 completed cross-chain swaps keep the deposit transaction hash, the Monero receiving address and the client IP in the same row.

Monero itself is not broken: the exposure sits in the swap service's off-chain database, which links public-chain deposits and exits to XMR addresses and connection metadata.

Some large orders carry source labels such as "Poloniex Hacker" and "DCENT Wallet Hacker", including six withdrawals worth about $1.03M routed to a single Monero address. Those labels come from Wagyu's own records and do not prove the funds were stolen.